Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f8898267 authored by Eric Biggers's avatar Eric Biggers Committed by Greg Kroah-Hartman
Browse files

binder: check for binder_thread allocation failure in binder_poll() 



If the kzalloc() in binder_get_thread() fails, binder_poll()
dereferences the resulting NULL pointer.

Fix it by returning POLLERR if the memory allocation failed.

This bug was found by syzkaller using fault injection.

Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Fixes: 457b9a6f ("Staging: android: add binder driver")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 7928b2cb

drivers/android/binder.c

+2 −0
Original line number Diff line number Diff line
@@ -4391,6 +4391,8 @@ static __poll_t binder_poll(struct file *filp, 
	bool wait_for_proc_work;



	thread = binder_get_thread(proc);

	if (!thread)

		return POLLERR;



	binder_inner_proc_lock(thread->proc);

	thread->looper |= BINDER_LOOPER_STATE_POLL;